The use of the internet as a platform for child sex offenders to communicate, store and share child sexual exploitation material (CSEM) and to hunt for new victims continues to be one of the internet’s most damaging and abhorrent aspects. In this chapter, we explore the current trends in the use of tools and techniques by online offenders and how they can identify, and exert their influence on, potential victims.
We welcome the adoption of the ‘Luxembourg Guidelines’ (the Terminology Guidelines for the Protection of Children from Sexual Exploitation and Sexual Abuse)45 as an important document to build consensus on key concepts and strengthen collaboration between relevant stakeholders, including investigators, judicial authorities and child protection agencies.
Online sexual coercion and extortion of children is the targeting and commoditisation of the child and/or their sexual image for the procurement of sexual gains, such as sexually explicit images of that child and/or sexual activity with the child, or for financial gain. This process is supported by a range of manipulative strategies, typically involving the use of coercion, through threats and intimidation, but also the use of deceptive strategies such as impersonation, hacking, or the theft of the child’s image.
There are two main types of sexual coercion and extortion: content driven, for sexual purposes, and financially driven, with an economic motivation.
This activity is usually characterised by grooming the child or impersonating another in order to gain their trust. Once this is established the offenders exploit the child’s vulnerabilities to obtain a photo or video of a sexual nature, which leads to the third phase – extortion. With content driven extortion the offender demands more photos/videos, commonly of an even more explicit nature. There can additionally be requests to involve a third person, such as a sibling or a friend, and to have offline meetings for sex. With financially driven extortion – as the name indicates – after obtaining the CSEM the child is asked for money to prevent further dissemination.
Both content and financially driven extortion is based on the threat to disclose the images on the internet and/or send it directly to family, friends, school, etc. Some research suggests that around 45% of offenders carry out their threats46.
The platforms used for sexual coercion or extortion are often social networks, online games and forums, all abundantly populated by minors. This is where the grooming process starts. Once they have gained the child’s attention or trust they can migrate the communications to other platforms that allow not only chat but also video and photo sharing. Today, many of these apps have end-to-end encryption enabled by default.
Many countries report that self-generated indecent material (SGIM) accounts for a growing volume of the CSEM in circulation. According to helpwanted.nl, 18% of SGIM is distributed further online by an unknown third party. Sexting is often used in the grooming process and by the offenders to threaten/blackmail the child; it is also seen today as an established trend amongst teenagers leading to higher quantities of CSEM available online.
Even though it is acknowledged by law enforcement worldwide as a rapidly growing problem, the growing trend of sexual coercion and extortion is still an understudied and underreported phenomenon, mostly due to the nature of the crime, including the shame and guilt felt by the victims. There are growing levels of complaints from parents against persons who attempt to obtain CSEM from their children. The accessibility of children is also higher than ever as a result of unprotected social media profiles, online games and greater access to broadband internet and mobile devices.
Some studies indicate that 100 million children will be coming online for the first time between 2012-2017, and that 80% of those will be connecting via mobile devices47. A significant proportion of these children will be connecting from African and South-East Asian countries.
There can be serious consequences for victims of this type of crime, including long-term psychological damage and an elevated risk of self-harm including suicide or suicide attempts. Therefore, the development of preventive campaigns to raise awareness and provide children with tools to protect themselves, and the knowledge to detect and deal with this phenomenon, are essential, especially in light of the fact that around 50% of victims prefer to discuss it with their peers.
Online access to CSEM has been facilitated by the expansion, greater accessibility and ‘user friendliness’ of tools that provide anonymisation and encryption of devices and communications. This allows an increasing number of offenders to access, download and trade CSEM more securely over the internet. This trend is reflected by the increased volume of seized material for forensic analysis in most recent cases.
One of the most popular platforms to exchange such material continues to be peer-to-peer (P2P) networks, although there has been an increase in the volume of exchanges carried out on platforms that allow anonymised access like Darknet networks (e.g. Tor).
There is also an increasing number of forums available on the Darknet that facilitate the exchange of CSEM, reflecting ongoing recovery from previous setbacks. This trend may be due to the growing popularity of Darknets which are no longer exclusive to more ‘sophisticated’ offenders but now easily accessible to those who are less technology savvy.
The continuing misuse of online social networking and other platforms on the surface net cannot be disregarded either. These continue to be used by offenders in innovative and devious ways to meet, discuss and propagate the creation and distribution of child abuse material.
Child sex offending is mostly based on a deviant sexual tendency48 and the currency amongst offender networks is CSEM. Unseen CSEM is of the highest value, therefore offenders with access to new material and those prepared to record or otherwise make available their abuse of children for distribution are the ones with higher status and influence within the community.
Reports from law enforcement stress that increasing numbers of victims are originating from geographic regions where previously there was little known activity. Non-Caucasian victims increasingly feature in the CSEM being exchanged by offenders. This trend can be at least partly explained by the increased penetration of broadband internet in regions such as Africa and South-East Asia and the consequential increased access to and misuse of online platforms.
There are also reports suggesting that the average age of the victims continues to fall and that CSEM continues to reflect more violent sexual abuse being inflicted on those children. In addition, activity in the areas of sexting and self-generated indecent material (SGIM) are also leading to an increase of CSEM online. A subset of this material is being generated in the context of sexual coercion and extortion as noted above.
To a lesser degree, there is also some evidence that forms of commercial child sexual exploitation such as on-demand live streaming of abuse is also contributing to the rise of the amount of CSEM online.
In parallel with other cybercriminals, child sex offenders increasingly favour the use of defensive measures that provide anonymisation and encryption of their online illegal activities in order to evade law enforcement. While this is partly due to the ready availability of such tools, it is also to some extent the result of knowledge sharing amongst offenders.
Common tools used by offenders include IP anonymisation tools, encryption for both devices and communications, wiping software or operating systems, virtualisation and cloud storage. Such techniques have been reported by some countries to be found in ‘almost all cases’. Historically the use of these techniques was associated with the more ‘sophisticated’ offenders. Today this is not the case, and it is becoming the norm.
Darknet and surface net platforms not only allow exchanging the newest CSEM but also allow the exchange of techniques to elude and hamper law enforcement activities. This mutual support and camaraderie is a worrying trend. Through the exchange of this knowledge offenders reduce their risk of discovery thus diminishing the seriousness of the offences, which may encourage previously reluctant offenders into ‘hands-on’ offending.
The use of encryption is an established trend and the use of encrypted communications has recently been heavily associated with sexual coercion and extortion cases. The use of encrypted devices is also growing, and poses a significant problem for evidence gathering as the content in the physical devices is not accessible to law enforcement or can be ‘wiped out’ by pre-installed software.
Live distant child abuse is still being reported as a growing threat. The live streaming of child sexual abuse on the internet involves a perpetrator directing the live abuse of children on a (pre-arranged) specific time-frame through video sharing platforms. The abuse can be ‘tailored’ to the requests of the soliciting offender(s) and recorded to further disseminate on Darknet sites and/or P2P networks. This dissemination contributes to the growth of CSEM available on the internet.
Live streaming abuse of children is facilitated by end-to-end encrypted platforms where not even the service providers can access what is being shared amongst their users, hampering the evidence collection and also weakening preventive approaches to tackling this crime. There are a great variety of payment methods available to the offenders, including digital currencies. Usually the amounts being transferred are low, and are therefore unlikely to generate alerts even if regulated financial services are used to transfer payments.
Traditionally the victims of live distant child abuse were based in South-East Asia, in particular the Philippines. More recent reports indicate that it is now spreading to other countries. Regions of the world with high levels of poverty, limited domestic child protection measures and easy access to children are being targeted by offenders for all types of CSEM, including live streaming.
There is evidence that supports the link between the live streaming of child sexual abuse and subsequent travelling for the purpose of child sexual exploitation – so-called hands-on offending. Following the live streaming abuse, the soliciting offender can travel to the country/place where the original abuse occurred so they themselves can sexually abuse the child. Equally, those who have travelled to abuse children may engage in live streaming activity on their return, having made the arrangements while in the country.
Live distant child abuse has the most obvious links with commercial distribution of CSEM. As new and/or unseen CSEM is valuable currency within the offending community, live distant abuse is therefore a way to not only acquire more CSEM, but to simultaneously generate material with a high ‘value’. It is a perverse way of converting money into the accepted currency and simultaneously gratifying their sexual urges. It is also linked to offenders’ forensic awareness as the activity leaves less traditional evidence on digital media.
In the last decade cybercrime and cyber-enabled crime have grown in parallel with rapid developments in technology, and show no signs of decelerating anytime soon. In the next few years, we can optimistically expect a shift in policies, on a national and international level, to better tackle these crimes, including online CSE. For instance, a new legal definition and criminalisation of online sexual coercion and extortion, rather than one that falls under the existing definition of extortion.
We can expect to encounter an increase in the use of anonymous payment systems such as digital currencies. Such payment systems, which are already integral to ransomware, may become the currency of choice for financially driven sexual extortion or for the payment of the live streaming of child sexual abuse.
The growing availability of internet-enabled mobile devices and their ownership amongst minors, coupled with the development of new and existing communication apps which focus on security, will create further areas of risk for potential victims and added challenges for law enforcement.
Advances in facial recognition software may lead to offenders using this technology to identify and/or locate potential victims in the real world through their social media by matching existing images in their possession to those published in the social media profiles49. Similarly, developments within apps and social media platforms in relation to geolocation may also make it easier for offenders seeking hands-on contact to locate their victims.
2016 has seen the release of several consumer virtual reality (VR) devices, with a number of other virtual and augmented reality products on the near horizon. It is possible that such devices could be used to simulate abuse on a virtual child or view CSEM. While there is currently no evidence that they are being used for such a purpose, the VR pornography industry is already well established in Asia and all it would require is someone with sufficient programming skills and intent to produce the appropriate content. Previous adoption of technologies by offenders and those with a commercial interest in this area would indicate this as a likely development.
